2

I have to authenticate certificate chain with my root certificate against server. I get the server certificate's NSData. We don't have any authenticationChallenge mechanism and need to verify using the NSData. How do I achieve this, because SecTrustEvaluate always returns kSecTrustResultRecoverableTrustFailure.

Following is the code I am using: -

NSData *aServerCertificateData = [NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"ABC" ofType:@"cer"]]; // This will actually come from the server
NSString *aRootPath = [[NSBundle mainBundle] pathForResource:@"XYZ" ofType:@"pem"];
CFDataRef aRootCertData = (__bridge CFDataRef)[NSData dataWithContentsOfFile:aRootPath];
CFDataRef myCertData = (__bridge CFDataRef)aServerCertificateData;
SecPolicyRef myPolicy = SecPolicyCreateBasicX509();

            SecCertificateRef certArray[1] = {myCert};
            CFArrayRef myCerts = CFArrayCreate(NULL, (void *)certArray, 1, NULL);
            SecTrustRef myTrust;
            OSStatus status = SecTrustCreateWithCertificates(myCerts, myPolicy, &myTrust);

            SecCertificateRef rootCertRef[1] = {rootCert};
            CFArrayRef rootCerts = CFArrayCreate(NULL, (void *)rootCertRef, 1, NULL);

            status = SecTrustSetAnchorCertificates(myTrust, rootCerts);

            SecTrustResultType trustResult;
            if (status == noErr) {
                status = SecTrustEvaluate(myTrust, &trustResult);
                if (status == noErr) {
                    if (trustResult == kSecTrustResultRecoverableTrustFailure) {// 2
                        NSData *exceptions = (__bridge NSData *)(SecTrustCopyExceptions(myTrust)); // This always gets called

                        NSLog(@"Exceptions: %@", [NSPropertyListSerialization propertyListWithData:exceptions options:kNilOptions format:nil error:nil]);
                    }


                    publicKeyRef = SecTrustCopyPublicKey(myTrust);
                }
            }
RandomGuy
  • 127
  • 1
  • 6

0 Answers0